Doommageddon · Ransomware · RaqibCTI

Knowledge/Actors/DoommageddonCorpus

+ Request intel workspace

ransomware

Doommageddon

Provisional

Ransomware

Motivation

—

Attribution confidence

Provisional — not yet assessed

Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, unrated confidence.

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Targets

SITTNAK Lojistik A.Ş.targetLeak-site claim · ransomware.live2026-08-28
Akpera Gayrimenkul Yatırım A.Ş.targetLeak-site claim · ransomware.live2026-08-28
Mercedes-Benz TurktargetLeak-site claim · ransomware.live2026-05-20
KOLORKIM KIMYAtargetLeak-site claim · ransomware.live2026-05-10
iw steelTEC Makine San. ve Tic. A.Ş.targetLeak-site claim · ransomware.live2026-03-08

Overview Attribution¹ TTPs Indicators Reporting Coverage

History

History profile is being researched

Will appear here shortly. Tracker note: Doommageddon is a ransomware group auto-tracked from public leak-site victim claims. This is a provisional, lightweight profile created because the group cleared an activity threshold — it has not been analyst-vetted and makes no attribution claim.

Useful?

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

Actorpayload
Actorkrybit
Actorapt73
Actornightspire
Actorlockbit5
ActorDeadlock